* Advisory ID: DRUPAL-SA-CONTRIB-2011-001 * Project: Webform (third-party module) * Version: 6.x * Date: 2011-January-10 * Security risk: Highly critical * Exploitable from: Remote * Vulnerability: SQL Injection
-------- DESCRIPTION ---------------------------------------------------------
The contributed webform module provides a webform nodetype. Typical uses for webform are to create questionnaires, contact or request/register forms, surveys, polls or a front end to issues tracking systems. The module does not properly use the database API, leading to an SQL Injection [1] vulnerability that can easily lead to a malicious user gaining full administrative access. No permissions are required to exploit this issue. The vulnerability is exploited in the wild. -------- VERSIONS AFFECTED ---------------------------------------------------
* Webform module 6.x-3.x versions prior to 6.x-3.5
Note: Webform 6.x-2.4 is not affected. Drupal core is not affected. If you do not use the contributed webform [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------
Install the latest version: * If you use the Webform module for Drupal 6.x upgrade to Webform 6.x-3.5 [3]
See also the Webform project page [4]. -------- REPORTED BY ---------------------------------------------------------
The vulnerability was reported publicly. -------- FIXED BY ------------------------------------------------------------
* Nathan Haug (quicksketch) [5]
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [6], writing secure code for Drupal [7], and secure configuration [8] of your site.
[1] http://en.wikipedia.org/wiki/SQL_injection [2] http://drupal.org/project/webform [3] http://drupal.org/node/1021180 [4] http://drupal.org/project/webform [5] http://drupal.org/user/35821 [6] http://drupal.org/security-team [7] http://drupal.org/writing-secure-code [8] http://drupal.org/security/secure-configuration